1 Mac OS X Malware Vulnerabilities (November 2008) Michael Grebenyuk, Albert Sodyl, Byron Thiessen, Sijia Wang and read By the operating system loader for that oBject format. Abstract—Mac OS X is commonly known to be a secure Various oBject formats exist, such as ELF, PE/COFF, and operating system however this is a misconception. Mac OS X Mach­O. does have security flaws and a proof­of­concept virus was created The Mach­O (Mach Object) oBject format is used By by the authors to exploit universal binary files. This virus infects other binaries on the system and captures private user data, operating systems Based on the Mach kernel, such as emailing it to the attacker. There are several possible defence NeXTSTEP and Mac OS X. The Mach­O format provides strategies to defend against exploits such the one presented. These Both intermediate and final storage of the machine code and include prevention using stricter access control with sandboxing, data. Features for dynamic linking were later added on top of and detection by various methods such as signature detection, the statically linked executable code at runtime, resulting in a change detection, and activity scanning. single file format that is Both dynamic and statically linked. The Basic Mach­O file contains three major regions (Fig. 1). Index Terms—Computer security, computer viruses I. INTRODUCTION PPLE advertises their Mac OS X operating system as A Being very secure through their marketing campaigns. A quote from their website claims that it “delivers the highest level of security through the adoption of industry standards, open software development and wise architectural decisions. ComBined, this intelligent design prevents the swarms of viruses and spyware that plague PCs these days” [1]. As a result of this, and the lack of prevalent malware on the platform, many Macintosh users Believe that Mac OS X really is secure. Advertisements such as the popular Mac vs. PC commercials only contribute to the hype, even for non­ Macintosh users. Therefore, most are oBlivious to malware threats on Mac OS X. However, the security of Mac OS is a myth, as it has vulnerabilities just like other operating systems, and should exploits Become more common, it would Fig. 1. Mach­O file format Basic structure. The 3 main regions are header, significantly increase the risk of using a Mac OS X [2], [3]. load commands and sections. Each segment command has zero or more section commands associated with it. This project analyzes how effective the security of Mac OS X really is when it comes to malware, such as viruses and At the Beginning of every Mach­O file is a header spyware. By presenting a working exploit in the form of a mach_header that identifies the file as a Mach­O type using a Mac OS X virus that does alarmingly malicious actions, we magic numBer 0xfeedface. The header also contains hope to gain the attention of Mac OS X users and provide information such as the CPU type, file type, total size of the insight on how Mac OS X is just as vulnerable as other load commands and various other flags that will affect the operating systems, and present strategies for defending against interpretation of the rest of the file. The mach_header such threats. structure is as follows: struct mach_header { II. BINARY FORMATS uint32_t magic; cpu_type_t cputype; A. Mach­O Format cpu_subtype_t cpusubtype; Operating systems use various oBject formats to store uint32_t filetype; uint32_t ncmds; executable code and their libraries and associated metadata. uint32_t sizeofcmds; They act as Blueprints for mapping out processes images in uint32_t flags; }; memory. Object files are created By compilers or assemBlers 2 Common CPU types supported include PowerPC (0x12) fat_header structure is Big endian on Both architectures, thus and x86 (0x7). CPU suBtypes define specific models of forcing a Byte swap on Intel machines. The fat_header processors and are usually 0x0 for PowerPC and 0x3 for Intel structure also contains information such as the archive offset Binaries. which allows the loader to take the native Binary required for Following the header are a series of load commands that certain types of architecture and run it as if it was a single specify the layout and linkage characteristics of the file. Mach­O. Because the native code is Being run, it executes just struct load_command { as fast as a pure native Mach­O file. The only drawBack to this uint32_t cmd; is the universal binary’s size. As mentioned before, universal uint32_t cmdsize; Binaries are simply archives of two Mach­O files which }; generally are douBle in size of a single Mach­O. However, This structure specifies the initial layout of the file in virtual this drawback doesn’t affect the end user significantly since memory, the initial execution state of the main thread of the file storage sizes have grown an astounding amount. program as well as location of symBol tables and names of shared libraries. The most important load commands are III. INFECTING MAC OS X BINARIES LC_SEGMENT, LC_THREAD, and LC_UNIXTHREAD. In particular, LC_THREAD holds the initial state of the registers A. Concatenation Method when a thread starts, this load_command can Be used to Apart from utilizing specific Mach­O Binary features, a retrieve or modify the entry point of a thread. simple way of infecting Binaries is with the concatenation The third section of the Mach­O is the Data section which is method. This method works By concatenating two Mach­O divided into one or more segments each containing zero or executable oBjects together. When the result is executed, only more sections pointed to By an LC_SEGMENT load command the first Binary will “run”. To use this as an exploit, a Binary (Fig. 1). Each segment defines a region of virtual memory that needs to Be created that knows its own size and contains a the dynamic linker maps into and each section of a segment potentially harmful payload within. We will call this Binary contains code or data of a particular type. Such information the ‘parasite’. To infect a host binary, it simply inserts itself in includes symBol taBles and string tables. the Beginning of the host Binary. In other words, it B. Fat Binaries and Universal Binaries concatenates the host Binary with itself, the copies itself to the location of the host Binary, overwriting it. When the infected Multiple Mach­O files can Be comBined into a multi­ host Binary executes, the parasite must seek to the end of itself, architecture Binary. A Binary file as such is also called a fat copy the rest of the Binary, which is the host program, into a Binary due to the increased size of the file. Fat Binaries temporary file and execute it as a child process. Then it include machine code for multiple instruction set architectures executes whatever payload desired either Before, during, or (ISAs) and thus can Be run on multiple processor types. The after the host binary is run. [6] fat Binary was developed By NeXT for their NeXTSTEP Such a method is trivial to implement in Mac OS X Because operating system to allow Motorola 68k and Intel IA­32 Based most Binaries are writable and it is possible for a process to processors to run the operating system without making open a file descriptor to its own Binary. Contrast this with separate versions. After Apple purchased NeXT in 1996, fat Linux where /proc/pid/mem must Be used. The location of the Binaries continued to Be supported in Mac OS X, but it wasn’t temporary file does not matter for all But some Objective­C until Apple announced their transition to Intel processors in applications that use @executable_path where the temporary 2005 that they really took off. Fat Binaries are not actually Binary must reside in the same folder as it was originally in. Binary files themselves but rather an archive of Binaries. The arguments and environment must Be passed unmodified Every fat Binary starts with a structure fat_header similar to when executing the temporary file in a fork so the application that of a single Mach­O file which contains two unsigned has the illusion that its first argument (the location of the integers magic and nfat_arch. The magic numBer is similar to Binary), has not changed. that in a Mach­O file since it also identifies the file as a fat Binary archive. However, for a fat Binary the magic numBer B. Resource Fork Method used is 0xcafebabe. The second unsigned integer is used to Mac OS X file system uses HFS+, a replacement for define how many Mach­O Binaries are contained within the Apple’s Hierarchical File System(HFS). Each file on a HFS+ archive. In Mac OS X, fat Binaries are used to support file partition has two forks, data and resource. To access a optimized codes for multiple variants of an architecture such file’s resource fork, the command <filename>/rsrc or as 32­Bit and 64­Bit PowerPC generations. <filename>/..namedfork/rsrc is used. To use this for an Later, Apple promoted the use of fat Binaries through their exploit, one can copy the host Binary into the resource fork of transition from PowerPC to Intel’s x86 architecture, giving fat the parasite file. The parasite file is then copied over top of the Binaries the name “Universal Binary”. It is interesting to note original host Binary, replacing it. When the new Binary is that PowerPC is a Big endian (higher order Bytes stored at executed, it simply executes the payload section Before or after lowest address) architecture, and Intel uses little endian (lower executing its resource fork.